Kenyan troops are combing a besieged mall in Nairobi, as terrorists who attacked the four-storey building said they are still holding hostages inside.

The al-Qaida-linked rebel group al-Shabaab said Islamist militants who laid siege to the Westgate shopping centre are holding their ground on the fourth day of a deadly standoff with Kenya's security forces.

At least 62 people have been killed and 170 injured in the attack. Among the victims are six Britons, the UK Foreign and Commonwealth Office said.

Al-Shabaab, a Somalia-based terrorist organisation, used one of its various Twitter accounts to post a picture of two of its fighters inside the mall and brag about the siege.

"The hostages who were being held by the Mujahideen inside #Westgate are still alive, looking quite disconcerted but, nevertheless, alive," al-Shabaab tweeted.

A security expert with contacts inside the mall told AP that there were at least 30 hostages when the assault began Saturday and at least 10 were believed to be still inside. The Red Cross said 51 people are missing.

An explosion and sporadic gunfire could be heard from the upscale shopping centre on Tuesday, signalling fighting is still ongoing.

Kenya's police said they are carrying out a clean-up of explosives that had been set up by the terrorists inside the building.

Security forces said 10 militants have been arrested and three have been killed, while "one or two" militants are barricaded in or around a casino on one of the upper floors of the complex.

Other Security sources put the militants' death toll at 6.

A 10 to 20-strong commando unit armed with grenades and assault rifles is believed to have carried out the attack.

Witnesses that escaped from the siege said the attackers were all young and spoke English.

Kenya's foreign minister said "two or three" Americans and a British woman were among the attackers.

Amina Mohamed told US TV programme PBS Newshour that the Americans were 18 or 19 years old and came from "Minnesota and one other place".

The British woman is largely believed to be Samantha Lewthwaite, 29, the widow of one of the 7/7 London bombers, who has been on the run in East Africa since she allegedly took part in a plot to stage a bomb attack in the city of Mombasa, Kenya in 2011.

UK Home Secretary Theresa May has said she cannot confirm or deny that a British woman was involved in the Westgate attack.

"I'm aware that there have been reports of a British woman being involved, but until we have seen the investigations completed, it is not possible to give further details to confirm or deny that issue," May said.

Earlier Kenyan interior minister Joseph Lenku had said that all of the terrorists were men, but some were dressed as women.

Al-Shabaab tweeted the photo of two of its militants in the siege of Westgate shopping centre in NairobiTwitterTaking cover behind a car along a road during heavy gunfire at Westgate shopping centre in NairobiReutersBritish-native Samantha Lewthwaite believed to be among the attackersTwitterPeople run from teargas as security officers disperse crowds near the security perimeter of the Westgate Shopping CentreReutersKenyan soldiers take a break near the Westgate shopping centreReutersAn attempt at light reliefReutersA police officer patrols the security perimeter at the Westgate Shopping Centre in NairobiReutersKenya Defence Forces armoured military vehicles approachReuters